Search: xss.is

A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetElements For Elementor up to version 2.9.2.6. This flaw involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can impact confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.

A stored cross-site scripting (XSS) vulnerability exists in weDevs Happy Addons for Elementor up to version 3.50.1. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with potential confidentiality, integrity, and availability consequences. No patch or fix information is currently provided.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins Flash & HTML5 Video html5-video-player up to version 2.14.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5.

A stored cross-site scripting (XSS) vulnerability exists in the Gutenberg Blocks by Kadence Blocks plugin for WordPress, affecting versions up to 3.8.0.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins StreamCast through version 2.4.6 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw impacts confidentiality, integrity, and availability to a limited extent. No patch information is currently provided.

A stored cross-site scripting (XSS) vulnerability exists in the Strong Testimonials plugin by WP Chill, affecting versions up to 3.3.15. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A stored cross-site scripting (XSS) vulnerability exists in PublishPress Authors up to version 4.17.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in Brainstorm Force SureDash versions up to 1.12.3. This flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A Cross-Site Scripting (XSS) vulnerability exists in the Brave browser's brave-popup-builder component due to improper neutralization of script-related HTML tags. This vulnerability allows code injection. It affects Brave versions up to 0.8.8. The vulnerability has a medium severity with a CVSS score of 5.3. No known exploits in the wild or patches are currently documented.

A stored cross-site scripting (XSS) vulnerability exists in Codection Import and export users and customers import-users-from-csv-with-meta component, affecting versions up to 2.5.9. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts that execute in the context of affected users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins PDF Poster versions up to 2.6.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

Multiple Pages Generator by Themeisle versions before 4.2.5 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with Contributor-level permissions to inject malicious scripts via the [mpg] and [mpg_match] shortcode base-url attribute. The vulnerability arises because entity-encoded payloads bypass kses filtering but are decoded and rendered unescaped in administrator browsers, enabling script execution.

A Cross-Site Scripting (XSS) vulnerability exists in the ThemeGrill User Registration plugin up to version 5.3.0. The flaw involves improper neutralization of script-related HTML tags, allowing an attacker to inject code. This vulnerability has a CVSS score of 5.3, indicating medium severity, and affects confidentiality but not integrity or availability.

A reflected cross-site scripting (XSS) vulnerability exists in the agent query feature of BMC Helix Operations Management version 25.4.00. This flaw allows authenticated attackers to execute arbitrary scripts in the browsers of other users who open a crafted link. The vulnerability has a medium severity rating with a CVSS score of 4.8.

A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetSmartFilters up to version 3.8.6.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts in the context of other users. The issue is rated medium severity with a CVSS score of 6.5.

A reflected cross-site scripting (XSS) vulnerability exists in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to inject malicious script content into HTML responses that are then viewed by other users, potentially leading to script execution in their browsers.

A Cross-Site Scripting (XSS) vulnerability exists in Brainstorm Force SureForms through version 2.12.9 due to improper neutralization of script-related HTML tags. This flaw allows an attacker to inject code into web pages. The vulnerability has a CVSS score of 5.3, indicating medium severity, and does not require user interaction or privileges to exploit.

Kali Forms versions up to 2.4.27 contain a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability. The issue is identified as CWE-79 and has a CVSS 3.1 base score of 6.5, indicating medium severity.

A stored cross-site scripting (XSS) vulnerability exists in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. This flaw allows authenticated users to inject malicious scripts that execute in the browsers of other users. The vulnerability has a medium severity rating with a CVSS score of 5.1. No public exploits or patches are currently documented.

The Post Grid plugin contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability affects versions up to and including 7.9.7. Exploitation could allow an attacker with low privileges to execute malicious scripts in the context of the affected application, potentially impacting confidentiality, integrity, and availability.